Coder Social home page Coder Social logo

lucassasha / spring-cloud-alibaba Goto Github PK

View Code? Open in Web Editor NEW

This project forked from alibaba/spring-cloud-alibaba

0.0 0.0 1.0 6.44 MB

Spring Cloud Alibaba provides a one-stop solution for application development for the distributed solutions of Alibaba middleware.

Home Page: https://spring.io/projects/spring-cloud-alibaba

License: Apache License 2.0

Shell 0.22% JavaScript 0.07% Java 98.78% HTML 0.78% Dockerfile 0.14%

spring-cloud-alibaba's Introduction

Spring Cloud Alibaba

CircleCI Maven Central Codecov License Leaderboard

A project maintained by Alibaba.

See the 中文文档 for Chinese readme.

Spring Cloud Alibaba provides a one-stop solution for distributed application development. It contains all the components required to develop distributed applications, making it easy for you to develop your applications using Spring Cloud.

With Spring Cloud Alibaba, you only need to add some annotations and a small amount of configurations to connect Spring Cloud applications to the distributed solutions of Alibaba, and build a distributed application system with Alibaba middleware.

Features

  • Flow control and service degradation: Flow control for HTTP services is supported by default. You can also customize flow control and service degradation rules using annotations. The rules can be changed dynamically.
  • Service registration and discovery: Service can be registered and clients can discover the instances using Spring-managed beans. Load balancing is consistent with that supported by the corresponding Spring Cloud.
  • Distributed configuration: Support for externalized configuration in a distributed system, auto refresh when configuration changes.
  • Event-driven: Support for building highly scalable event-driven microservices connected with shared messaging systems.
  • Distributed Transaction: Support for distributed transaction solution with high performance and ease of use.
  • Alibaba Cloud Object Storage: Massive, secure, low-cost, and highly reliable cloud storage services. Support for storing and accessing any type of data in any application, anytime, anywhere.
  • Alibaba Cloud SchedulerX: Accurate, highly reliable, and highly available scheduled job scheduling services with response time within seconds.
  • Alibaba Cloud SMS: A messaging service that covers the globe, Alibaba SMS provides convenient, efficient, and intelligent communication capabilities that help businesses quickly contact their customers.

For more features, please refer to Roadmap.

In addition to the above-mentioned features, for the needs of enterprise users' scenarios, Microservices Engine (MSE) of Spring Cloud Alibaba's enterprise version provides an enterprise-level microservices governance center, which includes more powerful governance capabilities such as Grayscale Release, Service Warm-up, Lossless Online and Offline and Outlier Ejection. At the same time, it also provides a variety of products and solutions such as enterprise-level Nacos registration / configuration center, enterprise-level cloud native gateway.

Components

Sentinel: Sentinel takes "traffic flow" as the breakthrough point, and provides solutions in areas such as flow control, concurrency, circuit breaking, and load protection to protect service stability.

Nacos: An easy-to-use dynamic service discovery, configuration and service management platform for building cloud native applications.

RocketMQ: A distributed messaging and streaming platform with low latency, high performance and reliability, trillion-level capacity and flexible scalability.

Seata: A distributed transaction solution with high performance and ease of use for microservices architecture.

Alibaba Cloud OSS: An encrypted and secure cloud storage service which stores, processes and accesses massive amounts of data from anywhere in the world.

Alibaba Cloud SMS: A messaging service that covers the globe, Alibaba SMS provides convenient, efficient, and intelligent communication capabilities that help businesses quickly contact their customers.

Alibaba Cloud SchedulerX: Accurate, highly reliable, and highly available scheduled job scheduling services with response time within seconds.

For more features please refer to Roadmap.

How to build

  • 2022.x branch: Corresponds to Spring Cloud 2022 & Spring Boot 3.0.x, JDK 17 or later versions are supported.
  • 2021.x branch: Corresponds to Spring Cloud 2021 & Spring Boot 2.6.x. JDK 1.8 or later versions are supported.
  • 2020.0 branch: Corresponds to Spring Cloud 2020 & Spring Boot 2.4.x. JDK 1.8 or later versions are supported.
  • 2.2.x branch: Corresponds to Spring Cloud Hoxton & Spring Boot 2.2.x. JDK 1.8 or later versions are supported.
  • greenwich branch: Corresponds to Spring Cloud Greenwich & Spring Boot 2.1.x. JDK 1.8 or later versions are supported.
  • finchley branch: Corresponds to Spring Cloud Finchley & Spring Boot 2.0.x. JDK 1.8 or later versions are supported.
  • 1.x branch: Corresponds to Spring Cloud Edgware & Spring Boot 1.x, JDK 1.7 or later versions are supported.

Spring Cloud uses Maven for most build-related activities, and you should be able to get off the ground quite quickly by cloning the project you are interested in and typing:

./mvnw install

How to Use

Add maven dependency

These artifacts are available from Maven Central and Spring Release repository via BOM:

<dependencyManagement>
    <dependencies>
        <dependency>
            <groupId>com.alibaba.cloud</groupId>
            <artifactId>spring-cloud-alibaba-dependencies</artifactId>
            <version>2022.0.0.0-RC2</version>
            <type>pom</type>
            <scope>import</scope>
        </dependency>
    </dependencies>
</dependencyManagement>

add the module in dependencies. If you want to choose an older version, you can refer to the Release Notes.

Reference Doc

Contents

Nacos Config

Nacos Discovery

Examples

A spring-cloud-alibaba-examples module is included in our project for you to get started with Spring Cloud Alibaba quickly. It contains an example, and you can refer to the readme file in the example project for a quick walkthrough.

Examples:

Sentinel Example

Nacos Config Example

Nacos Discovery Example

RocketMQ Example

Alibaba Cloud OSS Example

Version control guidelines

The version number of the project is in the form of x.x.x, where x is a number, starting from 0, and is not limited to the range 0~9. When the project is in the incubator phase, the version number is 0.x.x.

As the interfaces and annotations of Spring Boot 1 and Spring Boot 2 have been changed significantly in the Actuator module, and spring-cloud-commons is also changed quite a lot from 1.x.x to 2.0.0, we take the same version rule as SpringBoot version number.

  • 1.5.x for Spring Boot 1.5.x
  • 2.0.x for Spring Boot 2.0.x
  • 2.1.x for Spring Boot 2.1.x
  • 2.2.x for Spring Boot 2.2.x
  • 2020.x for Spring Boot 2.4.x
  • 2021.x for Spring Boot 2.6.x
  • 2022.x for Spring Boot 3.0.x

Code of Conduct

This project is a sub-project of Spring Cloud, it adheres to the Contributor Covenant code of conduct. By participating, you are expected to uphold this code. Please report unacceptable behavior to [email protected].

Code Conventions and Housekeeping

None of these is essential for a pull request, but they will all help. They can also be added after the original pull request but before a merge.

Use the Spring Framework code format conventions. If you use Eclipse you can import formatter settings using the eclipse-code-formatter.xml file from the Spring Cloud Build project. If using IntelliJ, you can use the Eclipse Code Formatter Plugin to import the same file.

Make sure all new .java files to have a simple Javadoc class comment with at least an @author tag identifying you, and preferably at least a paragraph on what the class is for.

Add the ASF license header comment to all new .java files (copy from existing files in the project)

Add yourself as an @author to the .java files that you modify substantially (more than cosmetic changes).

Add some Javadocs and, if you change the namespace, some XSD doc elements.

A few unit tests would help a lot as well —— someone has to do it.

If no-one else is using your branch, please rebase it against the current 2022.x (or other target branch in the main project).

When writing a commit message please follow these conventions, if you are fixing an existing issue please add Fixes gh-XXXX at the end of the commit message (where XXXX is the issue number).

Contact Us

Mailing list is recommended for discussing almost anything related to spring-cloud-alibaba.

[email protected]: You can ask questions here if you encounter any problem when using or developing spring-cloud-alibaba.

spring-cloud-alibaba's People

Contributors

fangjian0423 avatar mercyblitz avatar flystar32 avatar yuhuangbin avatar steverao avatar danielliu1123 avatar theonefx avatar pbting avatar xiaolongzuo avatar zkzlx avatar ruansheng8 avatar sorieee avatar zhendong590 avatar kaori-seasons avatar mostcool avatar slievrly avatar li-xiao-shuang avatar chuntaojun avatar echooymxq avatar xiejiashuai avatar zhaoyuguang avatar haojunren avatar lltx avatar yuluo-yx avatar xudaojie avatar spencergibb avatar 123liuziming avatar rivers-shall avatar dependabot[bot] avatar liudaomanbu avatar

Forkers

amaybaum-prod

spring-cloud-alibaba's Issues

log4j-1.2.17.jar: 8 vulnerabilities (highest severity is: 9.8)

Vulnerable Library - log4j-1.2.17.jar

Apache Log4j 1.2

Path to dependency file: /spring-cloud-alibaba-examples/seata-example/order-service/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/log4j/log4j/1.2.17/log4j-1.2.17.jar,/home/wss-scanner/.m2/repository/log4j/log4j/1.2.17/log4j-1.2.17.jar,/home/wss-scanner/.m2/repository/log4j/log4j/1.2.17/log4j-1.2.17.jar

Found in HEAD commit: c3404ab8524d51491c143dec1e808eadfa1ac8dc

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (log4j version) Remediation Possible** Reachability
CVE-2022-23305 Critical 9.8 log4j-1.2.17.jar Direct ch.qos.reload4j:reload4j:1.2.18.2
CVE-2020-9493 Critical 9.8 log4j-1.2.17.jar Direct ch.qos.reload4j:reload4j:1.2.18.1
CVE-2019-17571 Critical 9.8 log4j-1.2.17.jar Direct log4j-manual - 1.2.17-16;log4j-javadoc - 1.2.17-16;log4j - 1.2.17-16,1.2.17-16
CVE-2022-23307 High 8.8 log4j-1.2.17.jar Direct ch.qos.reload4j:reload4j:1.2.18.1
CVE-2022-23302 High 8.8 log4j-1.2.17.jar Direct ch.qos.reload4j:reload4j:1.2.18.1
CVE-2023-26464 High 7.5 log4j-1.2.17.jar Direct org.apache.logging.log4j:log4j-core:2.0
CVE-2021-4104 High 7.5 log4j-1.2.17.jar Direct uom-parent - 1.0.3-3.module,1.0.3-3.module;uom-se-javadoc - 1.0.4-3.module;parfait-examples - 0.5.4-4.module;log4j-manual - 1.2.17-16;si-units-javadoc - 0.6.5-2.module;unit-api - 1.0-5.module,1.0-5.module;unit-api-javadoc - 1.0-5.module;parfait - 0.5.4-4.module,0.5.4-4.module;log4j-javadoc - 1.2.17-16;uom-systems-javadoc - 0.7-1.module;uom-lib-javadoc - 1.0.1-6.module;uom-systems - 0.7-1.module,0.7-1.module;log4j - 1.2.17-16,1.2.17-16;uom-se - 1.0.4-3.module,1.0.4-3.module;uom-lib - 1.0.1-6.module,1.0.1-6.module;parfait-javadoc - 0.5.4-4.module;pcp-parfait-agent - 0.5.4-4.module;si-units - 0.6.5-2.module,0.6.5-2.module
CVE-2020-9488 Low 3.7 log4j-1.2.17.jar Direct ch.qos.reload4j:reload4j:1.2.18.3

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2022-23305

Vulnerable Library - log4j-1.2.17.jar

Apache Log4j 1.2

Path to dependency file: /spring-cloud-alibaba-examples/seata-example/order-service/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/log4j/log4j/1.2.17/log4j-1.2.17.jar,/home/wss-scanner/.m2/repository/log4j/log4j/1.2.17/log4j-1.2.17.jar,/home/wss-scanner/.m2/repository/log4j/log4j/1.2.17/log4j-1.2.17.jar

Dependency Hierarchy:

  • log4j-1.2.17.jar (Vulnerable Library)

Found in HEAD commit: c3404ab8524d51491c143dec1e808eadfa1ac8dc

Found in base branch: 2022.x

Vulnerability Details

By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout. The message converter, %m, is likely to always be included. This allows attackers to manipulate the SQL by entering crafted strings into input fields or headers of an application that are logged allowing unintended SQL queries to be executed. Note this issue only affects Log4j 1.x when specifically configured to use the JDBCAppender, which is not the default. Beginning in version 2.0-beta8, the JDBCAppender was re-introduced with proper support for parameterized SQL queries and further customization over the columns written to in logs. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.

Publish Date: 2022-01-18

URL: CVE-2022-23305

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://reload4j.qos.ch/

Release Date: 2022-01-18

Fix Resolution: ch.qos.reload4j:reload4j:1.2.18.2

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2020-9493

Vulnerable Library - log4j-1.2.17.jar

Apache Log4j 1.2

Path to dependency file: /spring-cloud-alibaba-examples/seata-example/order-service/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/log4j/log4j/1.2.17/log4j-1.2.17.jar,/home/wss-scanner/.m2/repository/log4j/log4j/1.2.17/log4j-1.2.17.jar,/home/wss-scanner/.m2/repository/log4j/log4j/1.2.17/log4j-1.2.17.jar

Dependency Hierarchy:

  • log4j-1.2.17.jar (Vulnerable Library)

Found in HEAD commit: c3404ab8524d51491c143dec1e808eadfa1ac8dc

Found in base branch: 2022.x

Vulnerability Details

A deserialization flaw was found in Apache Chainsaw versions prior to 2.1.0 which could lead to malicious code execution.

Publish Date: 2021-06-16

URL: CVE-2020-9493

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.openwall.com/lists/oss-security/2021/06/16/1

Release Date: 2021-06-16

Fix Resolution: ch.qos.reload4j:reload4j:1.2.18.1

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2019-17571

Vulnerable Library - log4j-1.2.17.jar

Apache Log4j 1.2

Path to dependency file: /spring-cloud-alibaba-examples/seata-example/order-service/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/log4j/log4j/1.2.17/log4j-1.2.17.jar,/home/wss-scanner/.m2/repository/log4j/log4j/1.2.17/log4j-1.2.17.jar,/home/wss-scanner/.m2/repository/log4j/log4j/1.2.17/log4j-1.2.17.jar

Dependency Hierarchy:

  • log4j-1.2.17.jar (Vulnerable Library)

Found in HEAD commit: c3404ab8524d51491c143dec1e808eadfa1ac8dc

Found in base branch: 2022.x

Vulnerability Details

Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j versions up to 1.2 up to 1.2.17.

Publish Date: 2019-12-20

URL: CVE-2019-17571

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://lists.apache.org/thread.html/eea03d504b36e8f870e8321d908e1def1addda16adda04327fe7c125%40%3Cdev.logging.apache.org%3E

Release Date: 2019-12-20

Fix Resolution: log4j-manual - 1.2.17-16;log4j-javadoc - 1.2.17-16;log4j - 1.2.17-16,1.2.17-16

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2022-23307

Vulnerable Library - log4j-1.2.17.jar

Apache Log4j 1.2

Path to dependency file: /spring-cloud-alibaba-examples/seata-example/order-service/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/log4j/log4j/1.2.17/log4j-1.2.17.jar,/home/wss-scanner/.m2/repository/log4j/log4j/1.2.17/log4j-1.2.17.jar,/home/wss-scanner/.m2/repository/log4j/log4j/1.2.17/log4j-1.2.17.jar

Dependency Hierarchy:

  • log4j-1.2.17.jar (Vulnerable Library)

Found in HEAD commit: c3404ab8524d51491c143dec1e808eadfa1ac8dc

Found in base branch: 2022.x

Vulnerability Details

CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Prior to Chainsaw V2.0 Chainsaw was a component of Apache Log4j 1.2.x where the same issue exists.

Publish Date: 2022-01-18

URL: CVE-2022-23307

CVSS 3 Score Details (8.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2022-01-18

Fix Resolution: ch.qos.reload4j:reload4j:1.2.18.1

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2022-23302

Vulnerable Library - log4j-1.2.17.jar

Apache Log4j 1.2

Path to dependency file: /spring-cloud-alibaba-examples/seata-example/order-service/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/log4j/log4j/1.2.17/log4j-1.2.17.jar,/home/wss-scanner/.m2/repository/log4j/log4j/1.2.17/log4j-1.2.17.jar,/home/wss-scanner/.m2/repository/log4j/log4j/1.2.17/log4j-1.2.17.jar

Dependency Hierarchy:

  • log4j-1.2.17.jar (Vulnerable Library)

Found in HEAD commit: c3404ab8524d51491c143dec1e808eadfa1ac8dc

Found in base branch: 2022.x

Vulnerability Details

JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the configuration references an LDAP service the attacker has access to. The attacker can provide a TopicConnectionFactoryBindingName configuration causing JMSSink to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-4104. Note this issue only affects Log4j 1.x when specifically configured to use JMSSink, which is not the default. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.

Publish Date: 2022-01-18

URL: CVE-2022-23302

CVSS 3 Score Details (8.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://reload4j.qos.ch/

Release Date: 2022-01-18

Fix Resolution: ch.qos.reload4j:reload4j:1.2.18.1

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2023-26464

Vulnerable Library - log4j-1.2.17.jar

Apache Log4j 1.2

Path to dependency file: /spring-cloud-alibaba-examples/seata-example/order-service/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/log4j/log4j/1.2.17/log4j-1.2.17.jar,/home/wss-scanner/.m2/repository/log4j/log4j/1.2.17/log4j-1.2.17.jar,/home/wss-scanner/.m2/repository/log4j/log4j/1.2.17/log4j-1.2.17.jar

Dependency Hierarchy:

  • log4j-1.2.17.jar (Vulnerable Library)

Found in HEAD commit: c3404ab8524d51491c143dec1e808eadfa1ac8dc

Found in base branch: 2022.x

Vulnerability Details

** UNSUPPORTED WHEN ASSIGNED **

When using the Chainsaw or SocketAppender components with Log4j 1.x on JRE less than 1.7, an attacker that manages to cause a logging entry involving a specially-crafted (ie, deeply nested)
hashmap or hashtable (depending on which logging component is in use) to be processed could exhaust the available memory in the virtual machine and achieve Denial of Service when the object is deserialized.

This issue affects Apache Log4j before 2. Affected users are recommended to update to Log4j 2.x.

NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

Publish Date: 2023-03-10

URL: CVE-2023-26464

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-vp98-w2p3-mv35

Release Date: 2023-03-10

Fix Resolution: org.apache.logging.log4j:log4j-core:2.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2021-4104

Vulnerable Library - log4j-1.2.17.jar

Apache Log4j 1.2

Path to dependency file: /spring-cloud-alibaba-examples/seata-example/order-service/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/log4j/log4j/1.2.17/log4j-1.2.17.jar,/home/wss-scanner/.m2/repository/log4j/log4j/1.2.17/log4j-1.2.17.jar,/home/wss-scanner/.m2/repository/log4j/log4j/1.2.17/log4j-1.2.17.jar

Dependency Hierarchy:

  • log4j-1.2.17.jar (Vulnerable Library)

Found in HEAD commit: c3404ab8524d51491c143dec1e808eadfa1ac8dc

Found in base branch: 2022.x

Vulnerability Details

JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and TopicConnectionFactoryBindingName configurations causing JMSAppender to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-44228. Note this issue only affects Log4j 1.2 when specifically configured to use JMSAppender, which is not the default. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.

Publish Date: 2021-12-14

URL: CVE-2021-4104

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2021-4104

Release Date: 2021-12-14

Fix Resolution: uom-parent - 1.0.3-3.module,1.0.3-3.module;uom-se-javadoc - 1.0.4-3.module;parfait-examples - 0.5.4-4.module;log4j-manual - 1.2.17-16;si-units-javadoc - 0.6.5-2.module;unit-api - 1.0-5.module,1.0-5.module;unit-api-javadoc - 1.0-5.module;parfait - 0.5.4-4.module,0.5.4-4.module;log4j-javadoc - 1.2.17-16;uom-systems-javadoc - 0.7-1.module;uom-lib-javadoc - 1.0.1-6.module;uom-systems - 0.7-1.module,0.7-1.module;log4j - 1.2.17-16,1.2.17-16;uom-se - 1.0.4-3.module,1.0.4-3.module;uom-lib - 1.0.1-6.module,1.0.1-6.module;parfait-javadoc - 0.5.4-4.module;pcp-parfait-agent - 0.5.4-4.module;si-units - 0.6.5-2.module,0.6.5-2.module

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2020-9488

Vulnerable Library - log4j-1.2.17.jar

Apache Log4j 1.2

Path to dependency file: /spring-cloud-alibaba-examples/seata-example/order-service/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/log4j/log4j/1.2.17/log4j-1.2.17.jar,/home/wss-scanner/.m2/repository/log4j/log4j/1.2.17/log4j-1.2.17.jar,/home/wss-scanner/.m2/repository/log4j/log4j/1.2.17/log4j-1.2.17.jar

Dependency Hierarchy:

  • log4j-1.2.17.jar (Vulnerable Library)

Found in HEAD commit: c3404ab8524d51491c143dec1e808eadfa1ac8dc

Found in base branch: 2022.x

Vulnerability Details

Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender. Fixed in Apache Log4j 2.12.3 and 2.13.1

Publish Date: 2020-04-27

URL: CVE-2020-9488

CVSS 3 Score Details (3.7)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://reload4j.qos.ch/

Release Date: 2020-04-27

Fix Resolution: ch.qos.reload4j:reload4j:1.2.18.3

⛑️ Automatic Remediation will be attempted for this issue.


⛑️Automatic Remediation will be attempted for this issue.

guava-31.1-jre.jar: 1 vulnerabilities (highest severity is: 5.5)

Vulnerable Library - guava-31.1-jre.jar

Guava is a suite of core and expanded libraries that include utility classes, Google's collections, I/O classes, and much more.

Path to dependency file: /spring-cloud-alibaba-tests/spring-cloud-alibaba-test-support/pom.xml

Path to vulnerable library: /tmp/ws-ua_20230509124156_XDGGON/downloadResource_XYRRRO/20230509124303/guava-31.1-jre.jar

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (guava version) Remediation Possible** Reachability
CVE-2023-2976 Medium 5.5 guava-31.1-jre.jar Direct 32.0.1-android

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2023-2976

Vulnerable Library - guava-31.1-jre.jar

Guava is a suite of core and expanded libraries that include utility classes, Google's collections, I/O classes, and much more.

Path to dependency file: /spring-cloud-alibaba-tests/spring-cloud-alibaba-test-support/pom.xml

Path to vulnerable library: /tmp/ws-ua_20230509124156_XDGGON/downloadResource_XYRRRO/20230509124303/guava-31.1-jre.jar

Dependency Hierarchy:

  • guava-31.1-jre.jar (Vulnerable Library)

Found in base branch: 2022.x

Vulnerability Details

Use of Java's default temporary directory for file creation in FileBackedOutputStream in Google Guava versions 1.0 to 31.1 on Unix systems and Android Ice Cream Sandwich allows other users and apps on the machine with access to the default Java temporary directory to be able to access the files created by the class.

Even though the security vulnerability is fixed in version 32.0.0, we recommend using version 32.0.1 as version 32.0.0 breaks some functionality under Windows.

Mend Note: Even though the security vulnerability is fixed in version 32.0.0, maintainers recommend using version 32.0.1 as version 32.0.0 breaks some functionality under Windows.

Publish Date: 2023-06-14

URL: CVE-2023-2976

CVSS 3 Score Details (5.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-7g45-4rm6-3mm3

Release Date: 2023-06-14

Fix Resolution: 32.0.1-android

⛑️ Automatic Remediation will be attempted for this issue.


⛑️Automatic Remediation will be attempted for this issue.

mysql-connector-java-8.0.28.jar: 1 vulnerabilities (highest severity is: 8.3)

Vulnerable Library - mysql-connector-java-8.0.28.jar

JDBC Type 4 driver for MySQL

Library home page: http://dev.mysql.com/doc/connector-j/en/

Path to dependency file: /spring-cloud-alibaba-examples/integrated-example/integrated-account/pom.xml

Path to vulnerable library: /tmp/ws-ua_20230509124156_XDGGON/downloadResource_XYRRRO/20230509124304/mysql-connector-java-8.0.28.jar,/spring-cloud-alibaba-examples/integrated-example/integrated-praise-consumer/pom.xml,/spring-cloud-alibaba-examples/integrated-example/integrated-storage/pom.xml,/tmp/ws-ua_20230509124156_XDGGON/downloadResource_XYRRRO/20230509124303/mysql-connector-java-8.0.28.jar

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (mysql-connector-java version) Remediation Possible** Reachability
CVE-2023-22102 High 8.3 mysql-connector-java-8.0.28.jar Direct com.mysql:mysql-connector-j:8.2.0

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2023-22102

Vulnerable Library - mysql-connector-java-8.0.28.jar

JDBC Type 4 driver for MySQL

Library home page: http://dev.mysql.com/doc/connector-j/en/

Path to dependency file: /spring-cloud-alibaba-examples/integrated-example/integrated-account/pom.xml

Path to vulnerable library: /tmp/ws-ua_20230509124156_XDGGON/downloadResource_XYRRRO/20230509124304/mysql-connector-java-8.0.28.jar,/spring-cloud-alibaba-examples/integrated-example/integrated-praise-consumer/pom.xml,/spring-cloud-alibaba-examples/integrated-example/integrated-storage/pom.xml,/tmp/ws-ua_20230509124156_XDGGON/downloadResource_XYRRRO/20230509124303/mysql-connector-java-8.0.28.jar

Dependency Hierarchy:

  • mysql-connector-java-8.0.28.jar (Vulnerable Library)

Found in base branch: 2022.x

Vulnerability Details

Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 8.1.0 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in MySQL Connectors, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H).

Publish Date: 2023-10-17

URL: CVE-2023-22102

CVSS 3 Score Details (8.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2023-22102

Release Date: 2023-10-17

Fix Resolution: com.mysql:mysql-connector-j:8.2.0

⛑️ Automatic Remediation will be attempted for this issue.


⛑️Automatic Remediation will be attempted for this issue.

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.